CN101170447A - Service failure diagnosis system based on active probe and its method - Google Patents

Abstract

The invention discloses a service fault diagnosis system and a method based on an active probe. The invention uses the active probe to effectively monitor the service performances in the network, so as to ensure the performances of using service of all the parts which are accessed in the network; when the invention discovers the abnormality by monitoring, the invention can rapidly and accurately position the source of fault according to the monitored symptoms. The invention has small cost of the monitoring and good fault diagnosis performance, at the same time, the invention selects the probe based on the uncertainty model, which can ensure the detection rate of each fault by smaller probe cost and obtain the good diagnosis performance.

Description

Service failure diagnosis system and method thereof based on the active probe

Technical field

The present invention relates to the service fault management domain, particularly a kind of service failure diagnosis system and method thereof based on the active probe.

Background technology

The symptom that failure diagnosis need obtain according to malfunction monitoring, use certain algorithm come the hypothesis that is out of order.The malfunction monitoring technology can be divided into passive and initiatively two kinds.Passive monitoring technology is used a large amount of monitoring facilitieses to monitor and has been deposited service conversation, generally collects based on the monitoring of service-user end or network packet and asks-respond reconstruct, notes abnormalities and then sends the alarm notification management system.The active monitoring technology sends probe from specified point to service and obtains the application layer performance, and a probe can be monitored the performance of one or more system component, can judge the situation of monitored assembly according to the return value of a plurality of probes.

Current most failure diagnosis is based on passive monitoring technology, the service performance of monitor user ' perception in real time, but expense is bigger, can reduce monitoring overhead based on the failure diagnosis of active monitoring technology, obtains diagnosis performance preferably equally.

In the prior art as at No. 2 2005 " Proactive Probing and Probing onDemand in Service Fault Localization " literary compositions of The International Journal of Intelligence Controland Systems the 2nd volume, the 107th page of the document---113 pages disclosed, based on the active probe service end system assembly situation is monitored, noting abnormalities and then utilize determinate fault---probe relies on model and further chooses probe, till being out of order in the source in diagnosis, at uncertainty, adopt the mode that simply sends probe once more to confirm that the probabilistic mode of this processing is too simple.The document is not considered the influence that transmission network causes the service performance of user institute perception in addition.

Also have in the prior art: at IEEE Transactions on Neural Networks (special issue on Adaptive Learning Systems in CommunicationNetworks) the 16th volume " Adaptive Diagnosis in DistributedSystems " literary composition No. 5 in September, 2005, the 1088th page of the document---1109 pages disclosed, based on the active probe distributed system carried out monitoring, diagnosing.Assumed fault---probe dependence is nearly certainty, adopts deterministic models when selecting probe, adopts the probability inference technology during tracing trouble, and this mode may be selected very few probe when choosing probe, and monitoring is less than the symptom of needs.

Summary of the invention

The objective of the invention is provides a kind of service failure diagnosis method based on the active probe at above-mentioned problems of the prior art, uses the service performance in the effective monitoring network of active probe, guarantees to use in each Access Network the performance of service; When monitoring notes abnormalities, orient fault rootstock rapidly and accurately according to the symptom that monitors.

The present invention solves the problems of the technologies described above and is achieved through the following technical solutions:

A kind of service failure diagnosis system based on the active probe, described fault diagnosis system comprises: probe, management host, interface module, management/information present module, fault detection module, fault diagnosis module, dependence model memory, effectively detecting probe information memory, alarm/fault message memory, and described probe is deployed on the probe station; Described management host and probe station present module, fault detection module, fault diagnosis module by interface module and management/information and link to each other; Described management/information presents module, fault detection module, fault diagnosis module and described dependence model memory, effective detecting probe information memory and alarm/fault message memory and links to each other respectively.

Described probe station can be positioned at and also can be positioned on the subscriber's main station on other special-purpose monitoring main frames.

A kind of diagnostic method of the service failure diagnosis system based on the active probe may further comprise the steps:

(1) chooses required probe of malfunction monitoring stage;

(2) the selected probe of step (1) is deployed on the corresponding probe station, periodically the Monitoring Service performance;

When (3) probe that sends is unusual, start described fault diagnosis module in monitoring step (2), further choose probe and observe service performance;

(4) according to the symptom that monitors in step (2) and (3), hypothesis must be out of order.

For possible breakdown the verification and measurement ratio threshold value is set in the described step (1).

In the described step (1) based on indeterminate fauit---probe relies on the greedy algorithm of Model Selection monitoring probe set.

The difference set of the probe subclass of selection possible breakdown correspondence is further observed service performance as diagnostic probe in the described step (3).

The present invention is based on initiatively, the service failure diagnosis system and the method thereof of probe have the following advantages:

The present invention is provided with the fault detect rate thresholding for contingent fault, according to aforesaid fault---and probe uncertain dependence model and verification and measurement ratio thresholding are set up the monitoring probe collection.These probes send application layer probe Monitoring Service performance from the Access Network that the user is positioned to service, note abnormalities with the verification and measurement ratio threshold value that defines.When the monitoring probe collection finds that service performance is unusual, can choose the diagnostic probe collection automatically apace and further observe service state, according to the hypothesis that must be out of order of observed result reasoning before.

The present invention relatively based on client measurement obtain the service failure diagnosis of service performance, can reduce monitoring overhead and prevent because the excessive interference that performance measurement may bring client.Packet Network Based is relatively collected and the service failure diagnosis of service performance mode is obtained in reconstruct request-response, can reduce difficulty and monitoring overhead that performance is collected.With respect to the active probe mode of using deterministic models, the application chooses probe based on uncertainty models, considered that the fault probe relies on intensity, thereby bring more accurate fault detect rate, for possible breakdown has added the verification and measurement ratio threshold value that can be provided with, effectively guaranteed verification and measurement ratio to each fault, use the algorithm picks probe described in the literary composition, guarantee the discovery that service performance is unusual with less probe expense, and obtained good diagnosis performance.

Description of drawings

Fig. 1 realizes fault diagnosis system schematic diagram of the present invention.

Fig. 2 realizes general flow chart of the present invention.

Fig. 3 is a process chart of choosing the malfunction monitoring probe among the present invention.

Fig. 4 is the flow chart in failure diagnosis stage of the present invention.

Embodiment

The present invention is further detailed explanation below in conjunction with accompanying drawing, and in the accompanying drawings: Fig. 1 realizes fault diagnosis system schematic diagram of the present invention.This system observes probe status, and carries out fault detection and diagnosis at probe station deploy probe.Fault Management System comprises probe, management host, and interface module, management/information presents module, fault detection module, fault diagnosis module relies on the model memory, effective detecting probe information memory, alarm/fault message memory.

Probe is the service conversation that is deployed on subscriber's main station or the special test main frame, can monitor the service performance that its position obtains when operation, and can report performance parameter to interface module.Management host can be visited the data that need, the operation of control management system by interface module.Interface module is responsible for the control information of inside or data are sent to management host and probe, and will send to corresponding internal module from the control information and the data of outside, and management/information presents module and presents administration interface to management host; According to instruction management system from management host; To write correspondence database from the data of outside, the malfunction monitoring probe is chosen and disposed to fault detection module, when appearance is unusual, start fault diagnosis module, fault diagnosis module is chosen diagnostic probe, reasoning draws fault rootstock according to probe structure, rely on model and store current probe-fault dependence model, effectively detecting probe information is stored current available detecting probe information, and alarm/fault message is stored all alarms and failure logging.

Fig. 2 realizes general flow chart of the present invention, and Fig. 3 is a process chart of choosing the malfunction monitoring probe among the present invention.At first choose required probe of malfunction monitoring stage, its detail is illustrated among Fig. 3, chooses to finish just probe to be deployed in the network afterwards, periodically the Monitoring Service performance.When monitoring probe when unusual, begin to carry out failure diagnosis, according to the symptom of previous stage, further choose probe, hypothesis must be out of order.

Fig. 3 is a process chart of choosing the malfunction monitoring probe among the present invention, comprises following a few step:

With all DQ _iThe probe of the fault correspondence of≤T adds the monitoring probe set, from F with these faults deletions, represent they monitored (step 101);

Because step 101 has added the part monitoring probe, these probes may cause other part probes to satisfy the verification and measurement ratio thresholding, therefore these faults need be deleted (step 102) from F;

From F, choose a minimum DQ of correspondence _iFault f _i(step 103);

Relatively in the probe of this fault correspondence, whether exist a plurality of meetings to cause identical maximum Sat _iProbe (step 104);

Therefrom select corresponding maximum TDQ _iProbe (step 105);

Select corresponding maximum Sat _iProbe (step 106);

This probe is added monitoring probe set (step 107);

Judge whether the fault that 103 steps are selected has satisfied verification and measurement ratio threshold requirement (step 108);

The probe (step 109) of verification and measurement ratio threshold requirement has been satisfied in deletion from F;

Need to judge whether the fault of monitoring all to monitor (step 110) with enough verification and measurement ratios;

Draw the monitoring probe set, it is deployed in the network, periodically Monitoring Service performance (step 111).

Fig. 4 has showed the flow chart in failure diagnosis stage.

According to the symptom that the monitoring stage is found, draw and to gather (201 step) by a big possible breakdown;

According to the possible breakdown set, described probe choosing method before using further obtains system mode (202 step);

The probe result who finds by malfunction monitoring and failure diagnosis stage, the reasoning hypothesis (203 step) that must be out of order.The main thought of reasoning algorithm is to import algorithm one by one with surveying all probe results that obtain before, and the mode of using reliability to upgrade is transmitted λ and π message between each node.Behind the end of input, select one by one _{Bel (1)}Maximum malfunctioning node adds the fault hypothesis, and carries out reliability and upgrade.Till all observed symptoms all can be explained by the fault hypothesis;

The validation fault hypothesis, fault recovery (204 step).

The present invention arranges the probe station in the residing Access Network of user, the probe station can be positioned on the subscriber's main station, also can be positioned on other special-purpose monitoring main frames.Can send probe to the service of needs monitoring from the probe station, thereby monitor the performance condition of using this service in this Access Network.A probe should arrive service through a path, thereby probe can reflect the situation in service and path.In the large scale network, may have a plurality of services and a plurality of Access Network, corresponding can send a plurality of probes.Too much monitoring probe can bring bigger expense, and we need reduce this expense, and guarantees the failure diagnosis performance.

This programme adopts two fens Bayesian network models to represent the prior probability of fault and the probability of cause between fault and the probe.These probability can obtain by the mode that analysis of history record and fault are injected.Failure collection is F={f ₁..., f _n, f _iF is broken down in=1 expression _i=0 expression is not broken down; Probe sets is combined into P={p ₁..., p _r, p _i=1 expression monitors unusual, p _i=0 expression does not monitor unusual; The prior probability that P (f) takes place for fault f; When P (p|f) took place for fault f, probe p detected unusual conditional probability; Child (f) is for existing causal probe set with fault f; Par (p) is for to exist causal failure collection with probe p.

The present invention is divided into two stages: malfunction monitoring and failure diagnosis.In the malfunction monitoring stage, periodically send a probe set of choosing in advance, reach the purpose of Monitoring Service performance.This monitoring probe set should be satisfied when arbitrary fault takes place, and has higher verification and measurement ratio that at least one probe is noted abnormalities.That is to say that to each possible breakdown, all there is a higher detection rate in this monitoring probe set, the big I of its value T is defined by the user.If current monitoring probe set is P _Det, to fault f _iThe verification and measurement ratio function definition be

$\mathrm{DQ}\left(P_{\det ,}{f}_i\right)=1-\underset{P_{\mathrm{ij}}\∈\mathrm{Child}\left(f_i\right)\∩P_{\det }}{\mathrm{\Π}}[1-P\left(p_{\mathrm{ij}}\right|f_i)].$

In order to accept to obtain high verification and measurement ratio on the expense basis, the present invention has adopted a greedy algorithm to obtain the monitoring probe set.Suppose current selected monitoring probe set P _Det, the thinking of this algorithm is from P-P _DetProbe is added P one by one _DetIn, up to P _DetSatisfy default fault detect rate requirement.To each probe p _i∈ P-P _Det, after we calculate and add this probe, satisfy the number of defects Sat of monitoring rate T _i

$N(P^{\&prime;},f_j)=\left\{\begin{array}{cc}1& \mathrm{DQ}(P^{\&prime;},f_j)\&GreaterEqual;T\\ 0& \mathrm{DQ}(p^{\&prime;},f_j)<T\end{array}\right.,$

$\mathrm{Sa}{t}_i=\underset{j=1}{\overset{n}{\mathrm{\&Sigma;}}}N(P_{\det }\&cup;\{p_i\},f_j).$

Will be corresponding to maximum Sat _iThe probe of value adds P _DetIf a plurality of probes have identical maximum Sat _iThe value, then choose corresponding maximum verification and measurement ratio and probe.Verification and measurement ratio and being defined as

${\mathrm{TDQ}}_i=\underset{j=1}{\overset{n}{\mathrm{\&Sigma;}}}\mathrm{DQ}(P_{\det }\&cup;\{p_i\},f_j).$

When all probes all are used for monitoring fault, that is to say P _Det=P, each fault all reaches maximum verification and measurement ratio, is defined as DQ _i=DQ (P, f _i).Each fault all has different DQ _iIf, the DQ lower of a fault than other faults _i, Child (f so _i) in probe more may be selected.Therefore when selecting probe, we select minimum DQ at every turn _iFault, from Child (f _i) the corresponding maximum Sat of middle selection _iProbe.

If fault f _iDQ _i≤ T even all probes all are used for monitoring so, can not satisfy thresholding T.In order to guarantee verification and measurement ratio, Child (f _i) in all probes all should add P _Det

The probe result that the failure diagnosis stage need obtain according to the malfunction monitoring stage further chooses probe and obtains system information, and uses the diagnosis algorithm hypothesis that must be out of order.

Based on the unusual probe set P that obtains previous stage _Neg, we can draw a possible breakdown set $\mathrm{Par}\left(P_{\mathrm{neg}}\right)=\underset{P_i\&Element;P_{\mathrm{neg}}}{\mathrm{\&cup;}}\mathrm{Par}\left(p_i\right),$ Wherein comprise institute and might cause P _NegFault.In order from this possible breakdown set, to find out the fault hypothesis, need further choose probe and observe.Considering only has causal probe with a possible breakdown, if this probe failure must be that this fault causes its failure so; If one has the failure of causal probe with a plurality of faults, then be difficult to determine is that fault causes this unusual actually.For this reason, this stage is only selected and P _NegIn a possible breakdown have causal probe further to observe.That is to say that we select the poor of the child of each possible breakdown and other possible breakdowns child, are expressed as

$P_{\mathrm{diag}}=\underset{f_i\&Element;\mathrm{Par}\left(P_{\mathrm{neg}}\right)}{\mathrm{\&cup;}}(\mathrm{Child}\left(f_i\right)-\underset{f_j\&Element;\mathrm{Par}\left(P_{\mathrm{neg}}\right),f_j\&NotEqual;f_i}{\mathrm{\&cup;}}\mathrm{Child}\left(f_j\right))-P_{\det }.$

According to above-mentioned all probe results that obtain, can use the mode reasoning that maximum probability is explained or reliability is upgraded to draw a fault hypothesis.

Claims (7)

1. service failure diagnosis system based on the active probe, described fault diagnosis system comprises: probe, management host, interface module, management/information present module, fault detection module, fault diagnosis module, dependence model memory, effectively detecting probe information memory, alarm/fault message memory, and described probe is placed on the probe station; Described management host and probe station present module, fault detection module, fault diagnosis module by interface module and management/information and link to each other; Described management/information presents module, fault detection module, fault diagnosis module and described dependence model memory, effective detecting probe information memory and alarm/fault message memory and links to each other respectively.

2. a kind of service failure diagnosis system based on the active probe according to claim 1 is characterized in that: described probe erect-position is on subscriber's main station.

3. a kind of service failure diagnosis system based on the active probe according to claim 1 is characterized in that: described probe erect-position is on special use monitoring main frame.

4. according to the diagnostic method of the described service failure diagnosis system based on the active probe of one of claim 1-3, may further comprise the steps:

(1) chooses required probe of malfunction monitoring stage;

(2) the selected probe of step (1) is deployed on the corresponding probe station, periodically the Monitoring Service performance;

When (3) probe that sends is unusual, start described fault diagnosis module in monitoring step (2), further choose probe and observe service performance;

(4) according to the symptom that monitors in step (2) and (3), hypothesis must be out of order.

5. the diagnostic method of the service failure diagnosis system based on the active probe according to claim 4 is characterized in that: for possible breakdown the verification and measurement ratio threshold value is set in described step (1).

6. the diagnostic method of the service failure diagnosis system based on the active probe according to claim 4 it is characterized in that: further comprising in described step (1) based on indeterminate fauit---and probe relies on the greedy algorithm of Model Selection monitoring probe set.

7. the diagnostic method of the service failure diagnosis system based on the active probe according to claim 4, the difference set that it is characterized in that: further comprising the probe subclass of selecting the possible breakdown correspondence in described step (3) is further observed service performance as diagnostic probe.

Images